Who we are
FlightBank ("we", "us") operates the website at flightbank.co.uk, which provides a free live flight-tracking map and a paid data API.
FlightBank is a trading name of William Coleman, a sole trader based in the United Kingdom, who is the data controller for the personal data described in this policy.
For any privacy question or request, contact [email protected].
If you just look at the map, we do not ask you for anything. You can browse without an account. We use analytics and advertising cookies, which you can control through the consent prompt. If you create an account we store your email address and a secure hash of your password; payment card details never reach our servers.
What we collect
If you only use the live map
No account is required and we do not ask you to identify yourself. Our hosting provider and security layer keep standard server logs, which include your IP address, browser user-agent, the pages requested and the time of the request. These are used to run and secure the service.
If you create an account
To register for API access we collect and store:
- your email address;
- a hashed version of your password — we store a one-way bcrypt hash, never the password itself, and we cannot recover or read it;
- a generated API key associated with your account;
- account and subscription status, including a Stripe customer reference if you subscribe.
If you subscribe to a paid plan
Payments are handled entirely by Stripe. You enter your card details on Stripe's own checkout, and we never see, receive or store your card number. We keep only a Stripe customer identifier and your subscription status so we know what your account is entitled to.
Cookies and similar technologies
| Cookie | Purpose | Type |
|---|---|---|
fb_sess / fb_session | Keeps you signed in to your account. Set as HttpOnly and Secure, so it cannot be read by scripts in your browser. | Strictly necessary |
| Google Analytics | Tells us how many people visit and which pages they use, in aggregate. | Analytics |
| Google AdSense | Serves the advertising that funds the free map, and may personalise it. | Advertising |
| Cloudflare | Security and abuse prevention in front of the site. | Strictly necessary |
Strictly necessary cookies are required for the site to function and are set without consent. Analytics and advertising cookies are only set in accordance with the choice you make in the consent prompt shown to visitors in the UK and the European Economic Area. You can change that choice at any time using the privacy settings link in the consent tool.
Third parties involved
Running the site means your browser contacts services we do not operate. Each has its own privacy policy:
| Service | What it does here |
|---|---|
| Google AdSense | Displays adverts on the guide pages. |
| Google Analytics | Aggregate visitor statistics. |
| Google Fonts | Serves the typefaces used across the site. |
| Stripe | Processes subscription payments. |
| Cloudflare | Sits in front of the site for performance and security. |
| IONOS | Hosts the website and its database. |
| OpenStreetMap and Esri | Supply the map tiles the radar is drawn on. |
| unpkg and cdnjs | Deliver the mapping library used by the radar. |
Some of these organisations are based outside the UK. Where personal data is transferred internationally, that transfer relies on the safeguards those providers put in place, such as the UK extension to the EU–US Data Privacy Framework or standard contractual clauses.
The aircraft shown on our map come from ADS-B signals that aircraft broadcast publicly and unencrypted. That data describes aircraft, not our visitors, and we do not use it to build any profile of the people using the site.
Why we are allowed to use your data
Under UK GDPR we rely on the following legal bases:
- Consent — for analytics and advertising cookies. You may withdraw it at any time.
- Performance of a contract — to create and run your account and provide a subscription you have paid for.
- Legitimate interests — to keep the service running, secure and free from abuse, and to keep basic server logs.
- Legal obligation — to retain records where the law requires it, such as for tax.
How long we keep it
- Account data — for as long as your account exists, and deleted on request.
- Payment and subscription records — retained as required for accounting and tax purposes.
- Server logs — kept for a short period for security and troubleshooting, then discarded.
- Analytics — retained according to the retention setting configured in Google Analytics.
Your rights
If you are in the UK or the EEA you have the right to:
- ask what personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent to analytics and advertising cookies at any time.
To exercise any of these, email [email protected]. We will respond within one month.
If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
Security
The site is served over HTTPS. Passwords are stored only as one-way bcrypt hashes. Session cookies are marked HttpOnly and Secure so they cannot be read by scripts or sent over an unencrypted connection. No system is perfectly secure, but we take reasonable measures appropriate to a service of this size.
Children
FlightBank is not directed at children and we do not knowingly collect personal data from anyone under 13. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy as the site changes. The date at the top always reflects the current version. Material changes will be made obvious on the site rather than applied quietly.